Privacy policy
Last updated: 8 September 2026
At Xtalvi we are committed to protecting your privacy. This policy describes what data we collect, what we use it for, and your rights under the GDPR.
Data controller
The data you enter in the app (expenses, tags, folders, friends, receipt photos) is processed by the controller identified below to provide the service to you.
- Controller: Pol Monleón Vives
- Tax ID: 26068795C
- Address: Carrer dels Assaonadors 19, 1º1ª
- Email: polmonleonvives@gmail.com
Data we process
Account data (email, name if provided), expenses and related data (amount, date, tag, folder, comment, optional photo), relationships with other users when you share expenses, and preferences (language, notifications). We do not sell or share your data with third parties for marketing.
Purpose
To provide the personal and shared expense management service, send you notifications and summaries you have agreed to, and comply with legal obligations.
AI chat
If you use the app's chat assistant, your messages and the data needed to generate the response (for example, your expenses or categories) are processed by external artificial intelligence providers (OpenAI and Groq), who act as data processors. This data may be processed outside the European Economic Area, under appropriate safeguards (standard contractual clauses). Your conversations are not used to train third-party models.
Legal basis for processing
We process your data on the following legal bases: performance of the service contract (registration, expenses, shared expenses, subscriptions), compliance with legal obligations (invoicing, tax), and your consent for sending notifications, summaries and communications you have agreed to, which you can withdraw at any time.
Retention period
We keep your data for as long as your account remains active. If you request deletion of your account, we remove your personal data, except information we must retain due to legal obligations (for example, billing data for the periods required by tax and commercial regulations).
Recipients and data processors
To provide the service, we share certain data with providers acting as data processors: Stripe (payment and subscription processing) and Google (sign-in via OAuth). On the free version of the app, Google AdSense also shows ads and may process advertising identifiers based on your consent, which you can manage or withdraw at any time from the app. These providers may be located outside the European Economic Area; in such cases, the transfer takes place under appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses. We do not share your data with third parties for our own marketing purposes.
Your rights
You can access your data in the app, correct it at any time, object to certain processing, request restriction of processing, request portability of your data, and request deletion of your account (all your data will be removed). Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. If you have outstanding debts, settle them before closing your account. To exercise your rights or for any queries, contact us. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you believe the processing of your data does not comply with the regulations, via www.aepd.es.
Contact
For any privacy questions or to exercise your rights, contact us at the email address shown in the app or on this website.